f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 05:09

Target

f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7.dll
Size

81KB
MD5

94942528e4fe87e59268bb70cd2d1a49
SHA1

a5fed2cd750453cc21d340362ce1cb05a31e9f39
SHA256

f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7
SHA512

ba1367aaab5b521e808fc0c4fbfcdbef232e0b10809adf7c5b8b28276b4a12dd23fa31354a5c6be2815faabd832b72721cc6ea36543d9d0c195a3df881261929
SSDEEP

1536:4ByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W+:lv4JKXTx71wnArSsXFpeXq8W+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4184	4188	rundll32.exe	91
PID 4188 wrote to memory of 4184	4188	rundll32.exe	91
PID 4188 wrote to memory of 4184	4188	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7.dll,#1
  2⤵
  PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1008